File http-joomla-brute
Script types:
portrule
Categories:
intrusive, brute
Download: http://nmap.org/svn/scripts/http-joomla-brute.nse
User Summary
Performs brute force password auditing against Joomla web CMS installations.
This script initially reads the session cookie and parses the security token to perfom the brute force password auditing. It uses the unpwdb and brute libraries to perform password guessing. Any successful guesses are stored using the credentials library.
Joomla's default uri and form names:
- Default uri:
/administrator/index.php - Default uservar:
username - Default passvar:
passwd
Script Arguments
http-joomla-brute.uservar
sets the http-variable name that holds the username used to authenticate. Default: username
http-joomla-brute.threads
sets the number of threads. Default: 3
Other useful arguments when using this script are:
- http.useragent = String - User Agent used in HTTP requests
- brute.firstonly = Boolean - Stop attack when the first credentials are found
- brute.mode = user/creds/pass - Username password iterator
- passdb = String - Path to password list
- userdb = String - Path to user list
Based on Patrik Karlsson's http-form-brute
http-joomla-brute.uri
Path to authentication script. Default: /administrator/index.php
http-joomla-brute.hostname
Virtual Hostname Header
http-joomla-brute.passvar
sets the http-variable name that holds the password used to authenticate. Default: passwd
passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb
See the documentation for the unpwdb library.http.max-cache-size, http.max-pipeline, http.pipeline, http.useragent
See the documentation for the http library.smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername
See the documentation for the smbauth library.Example Usage
nmap -sV --script http-joomla-brute
--script-args 'userdb=users.txt,passdb=passwds.txt,http-joomla-brute.hostname=domain.com,
http-joomla-brute.threads=3,brute.firstonly=true' <target>
nmap -sV --script http-joomla-brute <target>
Script Output
PORT STATE SERVICE REASON 80/tcp open http syn-ack | http-joomla-brute: | Accounts | xdeadbee:i79eWBj07g => Login correct | Statistics |_ Perfomed 499 guesses in 301 seconds, average tps: 0
Requires
Author: Paulino Calderon
License: Same as Nmap--See http://nmap.org/book/man-legal.html